|
|
Family: CGI abuses --> Category: destructive_attack
Admbook PHP Code Injection Flaw Vulnerability Scan
Vulnerability Scan Summary
Checks for remote PHP code injection in Admbook
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP script that allows arbitrary code
injection.
Description:
The remote host is running AdmBook, a PHP-based guestbook.
The remote version of this software is prone to remote PHP code
injection due to a lack of sanitization of the HTTP header
'X-Forwarded-For'. Using a specially-crafted URL, a malicious user
can execute arbitrary command on the remote server subject to the
rights of the web server user id.
See also :
http://downloads.securityfocus.com/vulnerabilities/exploits/admbook_122_xpl.pl
Solution :
Unknown at this time.
Threat Level:
High / CVSS Base Score : 7
(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
